Skip to content

Conversation

@mat-octave
Copy link
Contributor

Adds a feature to add metadata to a tool using the FastMCP.tool decorator, passing it to the Tool object.

Motivation and Context

ChatGPT's App SDK expects information about UI resources to be in a tool's _meta field. The decorator FastMCP.tool didn't accept metadata but the field exists on the lower-level mcp.Tool object.

How Has This Been Tested?

I added metadata to mcp.tool(...) and started the server successfully. I used the Model Inspector to list the tools, and the metadata was visible in the schema.

Breaking Changes

No, this just adds an optional field meta.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

mat-octaveand others added 3 commits October 14, 2025 11:47
Add tests covering: - Adding metadata via ToolManager.add_tool() - Adding metadata via FastMCP.tool() decorator - Metadata preservation in Tool objects - Metadata inclusion in MCPTool when listing tools - Edge cases (None, empty dict, complex nested structures) - Integration with tool annotations All tests verify that the meta parameter correctly flows through the tool registration and listing pipeline.
Copy link
Contributor

@maxisbeymaxisbey left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the submission @mat-octave ! I've gone ahead and pushed a unit test to your branch as well so we can get this merged :)

@maxisbeymaxisbey enabled auto-merge (squash) October 17, 2025 11:15
@maxisbeymaxisbey merged commit 98f8248 into modelcontextprotocol:mainOct 17, 2025
18 checks passed
@saqadri
Copy link
Contributor

@maxisbey can we get a minor bump for the package published to pypi with these changes? Thank you! And thanks @mat-octave for fixing this!

@felixweinberger
Copy link
Contributor

@maxisbey can we get a minor bump for the package published to pypi with these changes? Thank you! And thanks @mat-octave for fixing this!

We generally do releases on Thursdays, so this will be in there on 10/23

@saqadri
Copy link
Contributor

@maxisbey can we get a minor bump for the package published to pypi with these changes? Thank you! And thanks @mat-octave for fixing this!

We generally do releases on Thursdays, so this will be in there on 10/23

Perfect, thank you @felixweinberger!

@juanlarrambebere
Copy link

Hi! Very eager to try this release as well!

0Delta pushed a commit to 0Delta/python-sdk that referenced this pull request Nov 27, 2025
rbehal pushed a commit to gumloop/gumloop-mcp that referenced this pull request Dec 9, 2025
* Add regression test for stateless request memory cleanup (modelcontextprotocol#1140) * Implement RFC9728 - Support WWW-Authenticate header by MCP client (modelcontextprotocol#1071) * Add streamable HTTP starlette example to Python SDK docs (modelcontextprotocol#1111) * fix markdown error in README in main (modelcontextprotocol#1147) * README - replace code snippets with examples - add lowlevel to snippets (modelcontextprotocol#1150) * README - replace code snippets with examples - streamable http (modelcontextprotocol#1155) * chore: don't allow users to create issues outside the templates (modelcontextprotocol#1163) * Tests(cli): Add coverage for helper functions (modelcontextprotocol#635) * Docs: Update CallToolResult parsing in README (modelcontextprotocol#812) Co-authored-by: Felix Weinberger <[email protected]> * docs: add pre-commit install guide on CONTRIBUTING.md (modelcontextprotocol#995) Co-authored-by: Felix Weinberger <[email protected]> * fix flaky fix-test_streamablehttp_client_resumption test (modelcontextprotocol#1166) * README - replace code snippets with examples -- auth examples (modelcontextprotocol#1164) * Support falling back to OIDC metadata for auth (modelcontextprotocol#1061) * Add CODEOWNERS file for sdk (modelcontextprotocol#1169) * fix flaky test test_88_random_error (modelcontextprotocol#1171) * Make sure `RequestId` is not coerced as `int` (modelcontextprotocol#1178) * Fix: Replace threading.Lock with anyio.Lock for Ray deployment compatibility (modelcontextprotocol#1151) * fix: fix OAuth flow request object handling (modelcontextprotocol#1174) * update codeowners group (modelcontextprotocol#1191) * fix: perform auth server metadata discovery fallbacks on any 4xx (modelcontextprotocol#1193) * server: skip duplicate response on CancelledError (modelcontextprotocol#1153) Co-authored-by: ihrpr <[email protected]> * Unpack settings in FastMCP (modelcontextprotocol#1198) * chore: Remove unused prompt_manager.py file (modelcontextprotocol#1229) Co-authored-by: Tapan Chugh <[email protected]> * Improved supported for ProtectedResourceMetadata (modelcontextprotocol#1235) Co-authored-by: Paul Carleton <[email protected]> * chore: Remove unused variable notification_options (modelcontextprotocol#1238) * Improve README around the Context object (modelcontextprotocol#1203) * fix: allow to pass `list[str]` to `token_endpoint_auth_signing_alg_values_supported` (modelcontextprotocol#1226) * Remove strict validation on `response_modes_supported` member of `OAuthMetadata` (modelcontextprotocol#1243) * Add pyright strict mode on the whole project (modelcontextprotocol#1254) * Consistent casing for default headers Accept and Content-Type (modelcontextprotocol#1263) * Update dependencies and fix type issues (modelcontextprotocol#1268) Co-authored-by: Marcelo Trylesinski <[email protected]> * fix: prevent async generator cleanup errors in StreamableHTTP transport (modelcontextprotocol#1271) Co-authored-by: David Soria Parra <[email protected]> * chore: uncomment .idea/ in .gitignore (modelcontextprotocol#1287) Co-authored-by: Claude <[email protected]> * docs: clarify streamable_http_path configuration when mounting servers (modelcontextprotocol#1172) * feat: Add CORS configuration for browser-based MCP clients (modelcontextprotocol#1059) Co-authored-by: Marcelo Trylesinski <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Added Audio to FastMCP (modelcontextprotocol#1130) * fix: avoid uncessary retries in OAuth authenticated requests (modelcontextprotocol#1206) Co-authored-by: Felix Weinberger <[email protected]> * Add PATHEXT to default STDIO env vars in windows (modelcontextprotocol#1256) * fix: error too many values to unpack (expected 2) (modelcontextprotocol#1279) Signed-off-by: San Nguyen <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * SDK Parity: Avoid Parsing Server Response for non-JsonRPCMessage Requests (modelcontextprotocol#1290) * types: Setting default value for method: Literal (modelcontextprotocol#1292) * changes structured temperature to not deadly (modelcontextprotocol#1328) * Update simple-resource example to use non-deprecated read_resource return type (modelcontextprotocol#1331) Co-authored-by: Claude <[email protected]> * docs: Update README to include link to API docs for modelcontextprotocol#1329 (modelcontextprotocol#1330) * Allow ping requests before initialization (modelcontextprotocol#1312) * Python lint: Ruff rules for pylint and code complexity (modelcontextprotocol#525) * Fix context injection for resources and prompts (modelcontextprotocol#1336) * fix(fastmcp): propagate mimeType in resource template list (modelcontextprotocol#1186) Co-authored-by: Felix Weinberger <[email protected]> * fix: allow elicitations accepted without content (modelcontextprotocol#1285) Co-authored-by: Olivier Schiavo <[email protected]> * Use --frozen in pre-commit config (modelcontextprotocol#1375) * Return HTTP 403 for invalid Origin headers (modelcontextprotocol#1353) * Add test for ProtectedResourceMetadataParsing (modelcontextprotocol#1236) Co-authored-by: Paul Carleton <[email protected]> Co-authored-by: Marcelo Trylesinski <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Fastmcp logging progress example (modelcontextprotocol#1270) Co-authored-by: Felix Weinberger <[email protected]> * feat: add paginated list decorators for prompts, resources, and tools (modelcontextprotocol#1286) Co-authored-by: Claude <[email protected]> * Remove "unconditionally" from conditional description (modelcontextprotocol#1289) * Use streamable-http consistently in examples (modelcontextprotocol#1389) * feat: Add SDK support for SEP-1034 default values in elicitation schemas (modelcontextprotocol#1337) Co-authored-by: Tapan Chugh <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Implementation of SEP 973 - Additional metadata + icons support (modelcontextprotocol#1357) * Add error log for client stdio (modelcontextprotocol#924) Co-authored-by: Your Name <[email protected]> Co-authored-by: Marcelo Trylesinski <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Accept additional response_types values from OAuth servers (modelcontextprotocol#1323) * Issue 1379 patch - Fix MCP server OAuth not working with Visual Studio Code and others with extra grant_types (modelcontextprotocol#1380) * Add comprehensive Unicode tests for streamable HTTP transport (modelcontextprotocol#1381) * Update Icon.sizes to use string array format (modelcontextprotocol#1411) * Delete CODEOWNERS to eliminate notification overload (modelcontextprotocol#1413) * fix: fix the system message in simple-chatbot example (modelcontextprotocol#1394) * fix: improve misleading warning for progress callback exceptions (modelcontextprotocol#775) * fix: catch and rethrow SSEError during SSE connection establishment (modelcontextprotocol#975) Co-authored-by: zhangchuanhui <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Add icons support for ResourceTemplate (modelcontextprotocol#1412) * Add documentation structure (modelcontextprotocol#1425) * Add documentation about testing (modelcontextprotocol#1426) * Improve OAuth protected resource metadata URL construction per RFC 9728 (modelcontextprotocol#1407) * feat: add ability to remove tools (modelcontextprotocol#1322) Co-authored-by: David Soria Parra <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Max Isbey <[email protected]> Co-authored-by: Claude <[email protected]> * Update README to link to Python SDK documentation (modelcontextprotocol#1430) * fix: update CLAUDE.md to remove auto-addition of reviewers. (modelcontextprotocol#1431) * [client] Implement MCP OAuth scope selection and step-up authorization (modelcontextprotocol#1324) * Handles message type Exception in lowlevel/server.py _handle_message function. Mentioned as TODO on line 528. (modelcontextprotocol#786) Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Fix workspace configuration error with structured_output_lowlevel.py (modelcontextprotocol#1471) Co-authored-by: lorenss-m <[email protected]> * fix: Remove unnecessary constructor from ResourceServerSettings (modelcontextprotocol#1424) Co-authored-by: Felix Weinberger <[email protected]> * feat: add resource annotations support to FastMCP (modelcontextprotocol#1468) * fix: send params as empty object for list methods without cursor (modelcontextprotocol#1453) * fix: Set the Server session initialization state immediately after respond… (modelcontextprotocol#1478) Co-authored-by: Max Isbey <[email protected]> * feat: add tool metadata in FastMCP.tool decorator (modelcontextprotocol#1463) Co-authored-by: Max Isbey <[email protected]> * Make client examples workspaces to reflect package code (modelcontextprotocol#1466) * Expose RequestParams._meta in ClientSession.call_tool (modelcontextprotocol#1231) Co-authored-by: Felix Weinberger <[email protected]> * Allow CallToolResult to be returned directly to support _meta field for OpenAI Apps (modelcontextprotocol#1459) Co-authored-by: Max Isbey <[email protected]> * fix: uv CVE-2025-62518 astral-tokio-tar issue GHSA-j5gw-2vrg-8fgx (modelcontextprotocol#1505) * fix: use proper dependency resolution in CI (modelcontextprotocol#1507) * Upgrade GitHub Actions (modelcontextprotocol#1473) * test: use errno.ENOENT for command not found assertion (modelcontextprotocol#1498) * Replace deprecated dev-dependencies with dependency-groups (modelcontextprotocol#1488) Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * update uv to 0.9.5 (modelcontextprotocol#1510) * Relax Accept header requirement for JSON-only responses (modelcontextprotocol#1500) * fix: replace deprecated dev-dependencies in examples/clients (modelcontextprotocol#1518) * fix: Update spec links to new modelcontextprotocol.io location (modelcontextprotocol#1491) * fix: Replace fixed sleep with active server readiness check in SSE tests (modelcontextprotocol#1526) * fix: Replace arbitrary sleeps with active server readiness checks in tests (modelcontextprotocol#1527) Co-authored-by: Claude <[email protected]> * Fix flaky timeout test in test_88_random_error (modelcontextprotocol#1525) * fix: Replace remaining manual server polling with wait_for_server helper (modelcontextprotocol#1529) * Implement RFC 7523 JWT flows (modelcontextprotocol#1247) Co-authored-by: Yann Jouanin <[email protected]> * Fix pyright error and replace wildcard import with explicit imports (modelcontextprotocol#1532) * Fix auth client example URL handling for oauth provider (modelcontextprotocol#1549) * docs: use article "an" before "MCP" instead of "a" (modelcontextprotocol#1558) * Update Starlette to 0.49.1 in uv.lock (modelcontextprotocol#1559) * Fix typo in `ClientSessionGroup` doc string (modelcontextprotocol#1572) * Implement SEP-985: OAuth Protected Resource Metadata discovery fallback (modelcontextprotocol#1548) Co-authored-by: Claude <[email protected]> Co-authored-by: Paul Carleton <[email protected]> * Add --frozen flag to uv run commands in Claude config (modelcontextprotocol#1583) * Add get_server_capabilities() to ClientSession (modelcontextprotocol#1588) * Add everything-server for comprehensive MCP conformance testing (modelcontextprotocol#1587) * Get baseline 100% clean coverage (modelcontextprotocol#1553) * Add end-of-file-fixer pre-commit hook (modelcontextprotocol#1610) * Add coverage baseline commit to git-blame-ignore (modelcontextprotocol#1613) * Add SEP-1034 conformance test support to everything-server (modelcontextprotocol#1604) Co-authored-by: Max Isbey <[email protected]> * refactor: extract OAuth helper functions and simplify provider state (modelcontextprotocol#1586) * Add client_id_metadata_document_supported to OAuthMetadata (modelcontextprotocol#1603) * Fix OAuth discovery fallback and URL ordering (modelcontextprotocol#1624) * Refactor `func_metadata()` implementation (modelcontextprotocol#1496) * Fix CI highest resolution test to actually test highest versions (modelcontextprotocol#1609) * feat: Pass through and expose additional parameters in `ClientSessionGroup.call_tool` and `.connect_to_server` (modelcontextprotocol#1576) * fix get_client_metadata_scopes on 401 (modelcontextprotocol#1631) Co-authored-by: Max Isbey <[email protected]> * chore: Lazy import `jsonschema` library (modelcontextprotocol#1596) Co-authored-by: Max Isbey <[email protected]> * docs: Update examples to use stateless HTTP with JSON responses (modelcontextprotocol#1499) * Add tests for JSON Schema 2020-12 field preservation (SEP-1613) (modelcontextprotocol#1649) * Add client_secret_basic authentication support (modelcontextprotocol#1334) Co-authored-by: Paul Carleton <[email protected]> * Implement SEP-1577 - Sampling With Tools (modelcontextprotocol#1594) Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Claude <[email protected]> * SEP-1330: Elicitation Enum Schema Improvements and Standards Compliance (modelcontextprotocol#1246) Co-authored-by: Tapan Chugh <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * [auth][conformance] add conformance auth client (modelcontextprotocol#1640) Co-authored-by: Claude <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Implement SEP-986: Tool name validation (modelcontextprotocol#1655) * fix: url for spec (modelcontextprotocol#1659) * feat: implement SEP-991 URL-based client ID (CIMD) support (modelcontextprotocol#1652) Co-authored-by: Claude <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Update doc string on custom_route (modelcontextprotocol#1660) * Implement SEP-1036: URL mode elicitation for secure out-of-band interactions (modelcontextprotocol#1580) Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Skip empty SSE data to avoid parsing errors (modelcontextprotocol#1670) * SEP-1686: Tasks (modelcontextprotocol#1645) * Add on_session_created callback option (modelcontextprotocol#1710) * Add SSE polling support (SEP-1699) (modelcontextprotocol#1654) * Support client_credentials flow with JWT and Basic auth (modelcontextprotocol#1663) Co-authored-by: Claude <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * feat: backwards-compatible create_message overloads for SEP-1577 (modelcontextprotocol#1713) * Merge commit from fork * Auto-enable DNS rebinding protection for localhost servers When a FastMCP server is created with host="127.0.0.1" or "localhost" and no explicit transport_security is provided, automatically enable DNS rebinding protection. Both 127.0.0.1 and localhost are allowed as valid hosts/origins since clients may use either to connect. * Add tests for auto DNS rebinding protection on localhost Tests verify that: - Protection auto-enables for host=127.0.0.1 - Protection auto-enables for host=localhost - Both 127.0.0.1 and localhost are in allowed hosts/origins - Protection does NOT auto-enable for other hosts (e.g., 0.0.0.0) - Explicit transport_security settings are not overridden * Add IPv6 localhost (::1) support for DNS rebinding protection Extend auto-enable DNS rebinding protection to also cover IPv6 localhost. When host="::1", protection is now auto-enabled with appropriate allowed hosts ([::1]:*) and origins (http://[::1]:*). * Fix import ordering in test file * chore: update LATEST_PROTOCOL_VERSION to 2025-11-25 (modelcontextprotocol#1715) * fix: add lifespan context manager to StreamableHTTP mounting examples (modelcontextprotocol#1669) Co-authored-by: TheMailmans <[email protected]> Co-authored-by: Marcelo Trylesinski <[email protected]> * fix: handle ClosedResourceError in StreamableHTTP message router (modelcontextprotocol#1384) Co-authored-by: Max Isbey <[email protected]> Co-authored-by: Marcelo Trylesinski <[email protected]> * fix: skip priming events and close_sse_stream for old protocol versions (modelcontextprotocol#1719) * refactor(auth): remove unused _register_client method (modelcontextprotocol#1748) * [MCP-266] Add tests for Gumloop server extensions * Fix uv workspace config for gumloop-mcp package name * Sync with upstream MCP SDK and fix merge conflicts * Fix tool cache timing and missing properties check in server.py * Fix coverage and add proper type annotations for Gumloop extensions * Version up * Skip README code example tests (Gumloop README has no code snippets) --------- Signed-off-by: San Nguyen <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: yurikunash <[email protected]> Co-authored-by: Pamela Fox <[email protected]> Co-authored-by: Inna Harper <[email protected]> Co-authored-by: Marcelo Trylesinski <[email protected]> Co-authored-by: Ian Davenport <[email protected]> Co-authored-by: Dagang Wei <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Stanley Law <[email protected]> Co-authored-by: Luca Chang <[email protected]> Co-authored-by: leweng <[email protected]> Co-authored-by: Clare Liguori <[email protected]> Co-authored-by: lukacf <[email protected]> Co-authored-by: ihrpr <[email protected]> Co-authored-by: Tapan Chugh <[email protected]> Co-authored-by: Tapan Chugh <[email protected]> Co-authored-by: Yann Jouanin <[email protected]> Co-authored-by: Paul Carleton <[email protected]> Co-authored-by: Sreenath Somarajapuram <[email protected]> Co-authored-by: Omer Korner <[email protected]> Co-authored-by: joesavage-silabs <[email protected]> Co-authored-by: Gregory L <[email protected]> Co-authored-by: David Soria Parra <[email protected]> Co-authored-by: Moustapha Ebnou <[email protected]> Co-authored-by: Max Isbey <[email protected]> Co-authored-by: Claude <[email protected]> Co-authored-by: Jerome <[email protected]> Co-authored-by: xavier <[email protected]> Co-authored-by: keurcien <[email protected]> Co-authored-by: Tim Esler <[email protected]> Co-authored-by: San Nguyen <[email protected]> Co-authored-by: Justin Wang <[email protected]> Co-authored-by: jess <[email protected]> Co-authored-by: Peter Alexander <[email protected]> Co-authored-by: Reid Geyer <[email protected]> Co-authored-by: Eleftheria Stein-Kousathana <[email protected]> Co-authored-by: Christian Clauss <[email protected]> Co-authored-by: pchoudhury22 <[email protected]> Co-authored-by: owengo <[email protected]> Co-authored-by: Olivier Schiavo <[email protected]> Co-authored-by: Steve Billings <[email protected]> Co-authored-by: Mike Salvatore <[email protected]> Co-authored-by: pengwa <[email protected]> Co-authored-by: Your Name <[email protected]> Co-authored-by: Jon Shea <[email protected]> Co-authored-by: automaton82 <[email protected]> Co-authored-by: Yukuan Jia <[email protected]> Co-authored-by: Lorenzo <[email protected]> Co-authored-by: ZhangChuanhui <[email protected]> Co-authored-by: zhangchuanhui <[email protected]> Co-authored-by: Marcus Shu <[email protected]> Co-authored-by: Brandon Wu <[email protected]> Co-authored-by: Dogacan Colak <[email protected]> Co-authored-by: AishwaryaKalloli <[email protected]> Co-authored-by: lorenss-m <[email protected]> Co-authored-by: Rocky Haotian Du <[email protected]> Co-authored-by: Fenn Bailey <[email protected]> Co-authored-by: daamitt <[email protected]> Co-authored-by: Mat Leonard <[email protected]> Co-authored-by: Samuel Felipe Chenatti <[email protected]> Co-authored-by: Brandon Shar <[email protected]> Co-authored-by: mingo007 <[email protected]> Co-authored-by: adam jones <[email protected]> Co-authored-by: Yann Jouanin <[email protected]> Co-authored-by: Koichi ITO <[email protected]> Co-authored-by: Cole Murray <[email protected]> Co-authored-by: inaku <[email protected]> Co-authored-by: Chris Coutinho <[email protected]> Co-authored-by: Paul Carleton <[email protected]> Co-authored-by: Camila Rondinini <[email protected]> Co-authored-by: Victorien <[email protected]> Co-authored-by: Andrii Blyzniuk <[email protected]> Co-authored-by: Liang Wu <[email protected]> Co-authored-by: adam jones <[email protected]> Co-authored-by: Olivier Chafik <[email protected]> Co-authored-by: Tyler Mailman <[email protected]> Co-authored-by: TheMailmans <[email protected]> Co-authored-by: Edison <[email protected]>
rbehal added a commit to gumloop/gumloop-mcp that referenced this pull request Dec 10, 2025
* Add regression test for stateless request memory cleanup (modelcontextprotocol#1140) * Implement RFC9728 - Support WWW-Authenticate header by MCP client (modelcontextprotocol#1071) * Add streamable HTTP starlette example to Python SDK docs (modelcontextprotocol#1111) * fix markdown error in README in main (modelcontextprotocol#1147) * README - replace code snippets with examples - add lowlevel to snippets (modelcontextprotocol#1150) * README - replace code snippets with examples - streamable http (modelcontextprotocol#1155) * chore: don't allow users to create issues outside the templates (modelcontextprotocol#1163) * Tests(cli): Add coverage for helper functions (modelcontextprotocol#635) * Docs: Update CallToolResult parsing in README (modelcontextprotocol#812) Co-authored-by: Felix Weinberger <[email protected]> * docs: add pre-commit install guide on CONTRIBUTING.md (modelcontextprotocol#995) Co-authored-by: Felix Weinberger <[email protected]> * fix flaky fix-test_streamablehttp_client_resumption test (modelcontextprotocol#1166) * README - replace code snippets with examples -- auth examples (modelcontextprotocol#1164) * Support falling back to OIDC metadata for auth (modelcontextprotocol#1061) * Add CODEOWNERS file for sdk (modelcontextprotocol#1169) * fix flaky test test_88_random_error (modelcontextprotocol#1171) * Make sure `RequestId` is not coerced as `int` (modelcontextprotocol#1178) * Fix: Replace threading.Lock with anyio.Lock for Ray deployment compatibility (modelcontextprotocol#1151) * fix: fix OAuth flow request object handling (modelcontextprotocol#1174) * update codeowners group (modelcontextprotocol#1191) * fix: perform auth server metadata discovery fallbacks on any 4xx (modelcontextprotocol#1193) * server: skip duplicate response on CancelledError (modelcontextprotocol#1153) Co-authored-by: ihrpr <[email protected]> * Unpack settings in FastMCP (modelcontextprotocol#1198) * chore: Remove unused prompt_manager.py file (modelcontextprotocol#1229) Co-authored-by: Tapan Chugh <[email protected]> * Improved supported for ProtectedResourceMetadata (modelcontextprotocol#1235) Co-authored-by: Paul Carleton <[email protected]> * chore: Remove unused variable notification_options (modelcontextprotocol#1238) * Improve README around the Context object (modelcontextprotocol#1203) * fix: allow to pass `list[str]` to `token_endpoint_auth_signing_alg_values_supported` (modelcontextprotocol#1226) * Remove strict validation on `response_modes_supported` member of `OAuthMetadata` (modelcontextprotocol#1243) * Add pyright strict mode on the whole project (modelcontextprotocol#1254) * Consistent casing for default headers Accept and Content-Type (modelcontextprotocol#1263) * Update dependencies and fix type issues (modelcontextprotocol#1268) Co-authored-by: Marcelo Trylesinski <[email protected]> * fix: prevent async generator cleanup errors in StreamableHTTP transport (modelcontextprotocol#1271) Co-authored-by: David Soria Parra <[email protected]> * chore: uncomment .idea/ in .gitignore (modelcontextprotocol#1287) Co-authored-by: Claude <[email protected]> * docs: clarify streamable_http_path configuration when mounting servers (modelcontextprotocol#1172) * feat: Add CORS configuration for browser-based MCP clients (modelcontextprotocol#1059) Co-authored-by: Marcelo Trylesinski <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Added Audio to FastMCP (modelcontextprotocol#1130) * fix: avoid uncessary retries in OAuth authenticated requests (modelcontextprotocol#1206) Co-authored-by: Felix Weinberger <[email protected]> * Add PATHEXT to default STDIO env vars in windows (modelcontextprotocol#1256) * fix: error too many values to unpack (expected 2) (modelcontextprotocol#1279) Signed-off-by: San Nguyen <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * SDK Parity: Avoid Parsing Server Response for non-JsonRPCMessage Requests (modelcontextprotocol#1290) * types: Setting default value for method: Literal (modelcontextprotocol#1292) * changes structured temperature to not deadly (modelcontextprotocol#1328) * Update simple-resource example to use non-deprecated read_resource return type (modelcontextprotocol#1331) Co-authored-by: Claude <[email protected]> * docs: Update README to include link to API docs for modelcontextprotocol#1329 (modelcontextprotocol#1330) * Allow ping requests before initialization (modelcontextprotocol#1312) * Python lint: Ruff rules for pylint and code complexity (modelcontextprotocol#525) * Fix context injection for resources and prompts (modelcontextprotocol#1336) * fix(fastmcp): propagate mimeType in resource template list (modelcontextprotocol#1186) Co-authored-by: Felix Weinberger <[email protected]> * fix: allow elicitations accepted without content (modelcontextprotocol#1285) Co-authored-by: Olivier Schiavo <[email protected]> * Use --frozen in pre-commit config (modelcontextprotocol#1375) * Return HTTP 403 for invalid Origin headers (modelcontextprotocol#1353) * Add test for ProtectedResourceMetadataParsing (modelcontextprotocol#1236) Co-authored-by: Paul Carleton <[email protected]> Co-authored-by: Marcelo Trylesinski <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Fastmcp logging progress example (modelcontextprotocol#1270) Co-authored-by: Felix Weinberger <[email protected]> * feat: add paginated list decorators for prompts, resources, and tools (modelcontextprotocol#1286) Co-authored-by: Claude <[email protected]> * Remove "unconditionally" from conditional description (modelcontextprotocol#1289) * Use streamable-http consistently in examples (modelcontextprotocol#1389) * feat: Add SDK support for SEP-1034 default values in elicitation schemas (modelcontextprotocol#1337) Co-authored-by: Tapan Chugh <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Implementation of SEP 973 - Additional metadata + icons support (modelcontextprotocol#1357) * Add error log for client stdio (modelcontextprotocol#924) Co-authored-by: Your Name <[email protected]> Co-authored-by: Marcelo Trylesinski <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Accept additional response_types values from OAuth servers (modelcontextprotocol#1323) * Issue 1379 patch - Fix MCP server OAuth not working with Visual Studio Code and others with extra grant_types (modelcontextprotocol#1380) * Add comprehensive Unicode tests for streamable HTTP transport (modelcontextprotocol#1381) * Update Icon.sizes to use string array format (modelcontextprotocol#1411) * Delete CODEOWNERS to eliminate notification overload (modelcontextprotocol#1413) * fix: fix the system message in simple-chatbot example (modelcontextprotocol#1394) * fix: improve misleading warning for progress callback exceptions (modelcontextprotocol#775) * fix: catch and rethrow SSEError during SSE connection establishment (modelcontextprotocol#975) Co-authored-by: zhangchuanhui <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Add icons support for ResourceTemplate (modelcontextprotocol#1412) * Add documentation structure (modelcontextprotocol#1425) * Add documentation about testing (modelcontextprotocol#1426) * Improve OAuth protected resource metadata URL construction per RFC 9728 (modelcontextprotocol#1407) * feat: add ability to remove tools (modelcontextprotocol#1322) Co-authored-by: David Soria Parra <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Max Isbey <[email protected]> Co-authored-by: Claude <[email protected]> * Update README to link to Python SDK documentation (modelcontextprotocol#1430) * fix: update CLAUDE.md to remove auto-addition of reviewers. (modelcontextprotocol#1431) * [client] Implement MCP OAuth scope selection and step-up authorization (modelcontextprotocol#1324) * Handles message type Exception in lowlevel/server.py _handle_message function. Mentioned as TODO on line 528. (modelcontextprotocol#786) Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Fix workspace configuration error with structured_output_lowlevel.py (modelcontextprotocol#1471) Co-authored-by: lorenss-m <[email protected]> * fix: Remove unnecessary constructor from ResourceServerSettings (modelcontextprotocol#1424) Co-authored-by: Felix Weinberger <[email protected]> * feat: add resource annotations support to FastMCP (modelcontextprotocol#1468) * fix: send params as empty object for list methods without cursor (modelcontextprotocol#1453) * fix: Set the Server session initialization state immediately after respond… (modelcontextprotocol#1478) Co-authored-by: Max Isbey <[email protected]> * feat: add tool metadata in FastMCP.tool decorator (modelcontextprotocol#1463) Co-authored-by: Max Isbey <[email protected]> * Make client examples workspaces to reflect package code (modelcontextprotocol#1466) * Expose RequestParams._meta in ClientSession.call_tool (modelcontextprotocol#1231) Co-authored-by: Felix Weinberger <[email protected]> * Allow CallToolResult to be returned directly to support _meta field for OpenAI Apps (modelcontextprotocol#1459) Co-authored-by: Max Isbey <[email protected]> * fix: uv CVE-2025-62518 astral-tokio-tar issue GHSA-j5gw-2vrg-8fgx (modelcontextprotocol#1505) * fix: use proper dependency resolution in CI (modelcontextprotocol#1507) * Upgrade GitHub Actions (modelcontextprotocol#1473) * test: use errno.ENOENT for command not found assertion (modelcontextprotocol#1498) * Replace deprecated dev-dependencies with dependency-groups (modelcontextprotocol#1488) Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * update uv to 0.9.5 (modelcontextprotocol#1510) * Relax Accept header requirement for JSON-only responses (modelcontextprotocol#1500) * fix: replace deprecated dev-dependencies in examples/clients (modelcontextprotocol#1518) * fix: Update spec links to new modelcontextprotocol.io location (modelcontextprotocol#1491) * fix: Replace fixed sleep with active server readiness check in SSE tests (modelcontextprotocol#1526) * fix: Replace arbitrary sleeps with active server readiness checks in tests (modelcontextprotocol#1527) Co-authored-by: Claude <[email protected]> * Fix flaky timeout test in test_88_random_error (modelcontextprotocol#1525) * fix: Replace remaining manual server polling with wait_for_server helper (modelcontextprotocol#1529) * Implement RFC 7523 JWT flows (modelcontextprotocol#1247) Co-authored-by: Yann Jouanin <[email protected]> * Fix pyright error and replace wildcard import with explicit imports (modelcontextprotocol#1532) * Fix auth client example URL handling for oauth provider (modelcontextprotocol#1549) * docs: use article "an" before "MCP" instead of "a" (modelcontextprotocol#1558) * Update Starlette to 0.49.1 in uv.lock (modelcontextprotocol#1559) * Fix typo in `ClientSessionGroup` doc string (modelcontextprotocol#1572) * Implement SEP-985: OAuth Protected Resource Metadata discovery fallback (modelcontextprotocol#1548) Co-authored-by: Claude <[email protected]> Co-authored-by: Paul Carleton <[email protected]> * Add --frozen flag to uv run commands in Claude config (modelcontextprotocol#1583) * Add get_server_capabilities() to ClientSession (modelcontextprotocol#1588) * Add everything-server for comprehensive MCP conformance testing (modelcontextprotocol#1587) * Get baseline 100% clean coverage (modelcontextprotocol#1553) * Add end-of-file-fixer pre-commit hook (modelcontextprotocol#1610) * Add coverage baseline commit to git-blame-ignore (modelcontextprotocol#1613) * Add SEP-1034 conformance test support to everything-server (modelcontextprotocol#1604) Co-authored-by: Max Isbey <[email protected]> * refactor: extract OAuth helper functions and simplify provider state (modelcontextprotocol#1586) * Add client_id_metadata_document_supported to OAuthMetadata (modelcontextprotocol#1603) * Fix OAuth discovery fallback and URL ordering (modelcontextprotocol#1624) * Refactor `func_metadata()` implementation (modelcontextprotocol#1496) * Fix CI highest resolution test to actually test highest versions (modelcontextprotocol#1609) * feat: Pass through and expose additional parameters in `ClientSessionGroup.call_tool` and `.connect_to_server` (modelcontextprotocol#1576) * fix get_client_metadata_scopes on 401 (modelcontextprotocol#1631) Co-authored-by: Max Isbey <[email protected]> * chore: Lazy import `jsonschema` library (modelcontextprotocol#1596) Co-authored-by: Max Isbey <[email protected]> * docs: Update examples to use stateless HTTP with JSON responses (modelcontextprotocol#1499) * Add tests for JSON Schema 2020-12 field preservation (SEP-1613) (modelcontextprotocol#1649) * Add client_secret_basic authentication support (modelcontextprotocol#1334) Co-authored-by: Paul Carleton <[email protected]> * Implement SEP-1577 - Sampling With Tools (modelcontextprotocol#1594) Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Claude <[email protected]> * SEP-1330: Elicitation Enum Schema Improvements and Standards Compliance (modelcontextprotocol#1246) Co-authored-by: Tapan Chugh <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * [auth][conformance] add conformance auth client (modelcontextprotocol#1640) Co-authored-by: Claude <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Implement SEP-986: Tool name validation (modelcontextprotocol#1655) * fix: url for spec (modelcontextprotocol#1659) * feat: implement SEP-991 URL-based client ID (CIMD) support (modelcontextprotocol#1652) Co-authored-by: Claude <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Update doc string on custom_route (modelcontextprotocol#1660) * Implement SEP-1036: URL mode elicitation for secure out-of-band interactions (modelcontextprotocol#1580) Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * Skip empty SSE data to avoid parsing errors (modelcontextprotocol#1670) * SEP-1686: Tasks (modelcontextprotocol#1645) * Add on_session_created callback option (modelcontextprotocol#1710) * Add SSE polling support (SEP-1699) (modelcontextprotocol#1654) * Support client_credentials flow with JWT and Basic auth (modelcontextprotocol#1663) Co-authored-by: Claude <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> * feat: backwards-compatible create_message overloads for SEP-1577 (modelcontextprotocol#1713) * Merge commit from fork * Auto-enable DNS rebinding protection for localhost servers When a FastMCP server is created with host="127.0.0.1" or "localhost" and no explicit transport_security is provided, automatically enable DNS rebinding protection. Both 127.0.0.1 and localhost are allowed as valid hosts/origins since clients may use either to connect. * Add tests for auto DNS rebinding protection on localhost Tests verify that: - Protection auto-enables for host=127.0.0.1 - Protection auto-enables for host=localhost - Both 127.0.0.1 and localhost are in allowed hosts/origins - Protection does NOT auto-enable for other hosts (e.g., 0.0.0.0) - Explicit transport_security settings are not overridden * Add IPv6 localhost (::1) support for DNS rebinding protection Extend auto-enable DNS rebinding protection to also cover IPv6 localhost. When host="::1", protection is now auto-enabled with appropriate allowed hosts ([::1]:*) and origins (http://[::1]:*). * Fix import ordering in test file * chore: update LATEST_PROTOCOL_VERSION to 2025-11-25 (modelcontextprotocol#1715) * fix: add lifespan context manager to StreamableHTTP mounting examples (modelcontextprotocol#1669) Co-authored-by: TheMailmans <[email protected]> Co-authored-by: Marcelo Trylesinski <[email protected]> * fix: handle ClosedResourceError in StreamableHTTP message router (modelcontextprotocol#1384) Co-authored-by: Max Isbey <[email protected]> Co-authored-by: Marcelo Trylesinski <[email protected]> * fix: skip priming events and close_sse_stream for old protocol versions (modelcontextprotocol#1719) * refactor(auth): remove unused _register_client method (modelcontextprotocol#1748) * [MCP-266] Add tests for Gumloop server extensions * Fix uv workspace config for gumloop-mcp package name * Sync with upstream MCP SDK and fix merge conflicts * Fix tool cache timing and missing properties check in server.py * Fix coverage and add proper type annotations for Gumloop extensions * Version up * Skip README code example tests (Gumloop README has no code snippets) * Support gumloop and mcp outptuschema * Add publish tools to dev dependencies and update README for uv --------- Signed-off-by: San Nguyen <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: yurikunash <[email protected]> Co-authored-by: Pamela Fox <[email protected]> Co-authored-by: Inna Harper <[email protected]> Co-authored-by: Marcelo Trylesinski <[email protected]> Co-authored-by: Ian Davenport <[email protected]> Co-authored-by: Dagang Wei <[email protected]> Co-authored-by: Felix Weinberger <[email protected]> Co-authored-by: Stanley Law <[email protected]> Co-authored-by: Luca Chang <[email protected]> Co-authored-by: leweng <[email protected]> Co-authored-by: Clare Liguori <[email protected]> Co-authored-by: lukacf <[email protected]> Co-authored-by: ihrpr <[email protected]> Co-authored-by: Tapan Chugh <[email protected]> Co-authored-by: Tapan Chugh <[email protected]> Co-authored-by: Yann Jouanin <[email protected]> Co-authored-by: Paul Carleton <[email protected]> Co-authored-by: Sreenath Somarajapuram <[email protected]> Co-authored-by: Omer Korner <[email protected]> Co-authored-by: joesavage-silabs <[email protected]> Co-authored-by: Gregory L <[email protected]> Co-authored-by: David Soria Parra <[email protected]> Co-authored-by: Moustapha Ebnou <[email protected]> Co-authored-by: Max Isbey <[email protected]> Co-authored-by: Claude <[email protected]> Co-authored-by: Jerome <[email protected]> Co-authored-by: xavier <[email protected]> Co-authored-by: keurcien <[email protected]> Co-authored-by: Tim Esler <[email protected]> Co-authored-by: San Nguyen <[email protected]> Co-authored-by: Justin Wang <[email protected]> Co-authored-by: jess <[email protected]> Co-authored-by: Peter Alexander <[email protected]> Co-authored-by: Reid Geyer <[email protected]> Co-authored-by: Eleftheria Stein-Kousathana <[email protected]> Co-authored-by: Christian Clauss <[email protected]> Co-authored-by: pchoudhury22 <[email protected]> Co-authored-by: owengo <[email protected]> Co-authored-by: Olivier Schiavo <[email protected]> Co-authored-by: Steve Billings <[email protected]> Co-authored-by: Mike Salvatore <[email protected]> Co-authored-by: pengwa <[email protected]> Co-authored-by: Your Name <[email protected]> Co-authored-by: Jon Shea <[email protected]> Co-authored-by: automaton82 <[email protected]> Co-authored-by: Yukuan Jia <[email protected]> Co-authored-by: Lorenzo <[email protected]> Co-authored-by: ZhangChuanhui <[email protected]> Co-authored-by: zhangchuanhui <[email protected]> Co-authored-by: Marcus Shu <[email protected]> Co-authored-by: Brandon Wu <[email protected]> Co-authored-by: Dogacan Colak <[email protected]> Co-authored-by: AishwaryaKalloli <[email protected]> Co-authored-by: lorenss-m <[email protected]> Co-authored-by: Rocky Haotian Du <[email protected]> Co-authored-by: Fenn Bailey <[email protected]> Co-authored-by: daamitt <[email protected]> Co-authored-by: Mat Leonard <[email protected]> Co-authored-by: Samuel Felipe Chenatti <[email protected]> Co-authored-by: Brandon Shar <[email protected]> Co-authored-by: mingo007 <[email protected]> Co-authored-by: adam jones <[email protected]> Co-authored-by: Yann Jouanin <[email protected]> Co-authored-by: Koichi ITO <[email protected]> Co-authored-by: Cole Murray <[email protected]> Co-authored-by: inaku <[email protected]> Co-authored-by: Chris Coutinho <[email protected]> Co-authored-by: Paul Carleton <[email protected]> Co-authored-by: Camila Rondinini <[email protected]> Co-authored-by: Victorien <[email protected]> Co-authored-by: Andrii Blyzniuk <[email protected]> Co-authored-by: Liang Wu <[email protected]> Co-authored-by: adam jones <[email protected]> Co-authored-by: Olivier Chafik <[email protected]> Co-authored-by: Tyler Mailman <[email protected]> Co-authored-by: TheMailmans <[email protected]> Co-authored-by: Edison <[email protected]> Co-authored-by: dvlpjrs <[email protected]>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs maintainer actionPotentially serious issue - needs proactive fix and maintainer attention

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Availability of the meta parameter in tool definition on the server

5 participants

@mat-octave@saqadri@felixweinberger@juanlarrambebere@maxisbey